On this page

Fixing DKIM in GoDaddy for Microsoft 365

What this fixes

DKIM lets receiving servers verify your mail hasn't been altered in transit and really came from you. See Fixing DKIM Record Issues for what it does and why it matters.

Important: unlike most DNS-based email checks, Microsoft 365's DKIM record is a CNAME, not a TXT record — and you need two of them.

This assumes GoDaddy is managing your DNS (not just registration with DNS hosted elsewhere).

Step 1: Get your exact CNAME values from Microsoft

  1. Go to the Microsoft Defender portal (security.microsoft.com) → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM tab.
  2. Select your domain. Microsoft shows you the two CNAME records to publish.
  3. Copy the two selector names and their target values exactly as shown — the target format varies by when your domain was added, so copy it directly rather than guessing the pattern.

You'll get two records, typically named selector1._domainkey and selector2._domainkey.

Step 2: Publish both in GoDaddy

For each of the two records:

  1. Log in to your GoDaddy account and go to your Domain Portfolio.
  2. Select your domain to open Domain Settings, then click the DNS tab.
  3. Under Records, click Add.
  4. Set Type to CNAME.
  5. Name/Host: the selector Microsoft gave you (e.g. selector1._domainkey).
  6. Points to: the exact value Microsoft gave you.
  7. Click Save.
  8. Repeat for the second record.

Step 3: Turn on DKIM signing

  1. Back in the Defender portal's DKIM tab, wait for DNS to propagate, then toggle the domain to Enabled.
  2. Confirm Sign messages for this domain with DKIM signatures is on.
  3. Re-run your scan to confirm.

Common pitfalls

  • Adding these as TXT records instead of CNAME — GoDaddy's DNS list can make it easy to default to TXT out of habit; Microsoft's DKIM records are specifically CNAME.
  • Hardcoding a .onmicrosoft.com target instead of copying the exact value from the Defender portal.
  • Publishing the CNAME records but never flipping DKIM to Enabled in the Defender portal.